Article ID: 891559
After you install Microsoft Security Bulletin MS04-011 or Microsoft Windows XP Service Pack 2 (SP2) on your computer, you experience problems accessing resources in a domain when no domain controller is available. This issue occurs when you try to access a Distributed File System (DFS) share in an untrusted domain. In a Network Monitor trace, you will see the error STATUS_DOWNGRADE_DETECTED. When you try to connect to resources, you cannot gain access, and the System event log contains the following events:
In Microsoft Security Bulletin MS04-011, which is also included in Windows XP SP2, there is a change in the Kerberos authentication. It no longer allows for a fallback to NTLM when a domain controller cannot be accessed. If you cannot contact a Key Distribution Center (KDC), you cannot connect to resources.
To access a DFS share resource, you can use either of the following methods:
Note You install Security Bulletin MS04-011or Windows XP SP2 so that the domain member computers are more secure because the new authentication protocols (Kerberos) are more secure. For example, Kerberos offers mutual authentication.
For more information about DFS, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/812487/ )Overview of DFS in Windows 2000
For additional information about Network Monitor, visit the following Microsoft Web site:
For additional information about Security Bulletin MS04-011, visit the following Microsoft Web site: